Monitoring apparatus, computer program and network for secure data storage

ABSTRACT

A monitoring apparatus, a computer program and a network are disclosed for monitoring a representation. The representation comprises a first data string and afterwards two or more output strings are generated by the monitoring apparatus which output strings are stored at separate storage locations.

BACKGROUND

[0001] 1. Field of the Invention

[0002] The invention relates to a monitoring apparatus, a computerprogram and a network for secure storage of data.

[0003] 2. Background

[0004] The growing societal demand for privacy is on a collision coursewith the increased need for surveillance such as e.g. camerasurveillance, arising from growing crime and civil disputes. As anexample it happens more and more frequently that specific areas, such ase.g. main city squares, airports or stadiums hosting sports events orrock concerts, need to be watched because of rising crime, expectedtroubles with unknown groups of people or more general securityconsiderations. On the other hand the privacy of individuals has becomea fundamental right of people. Camera surveillance will obviously be inconflict with the right of privacy and will therefore encounter strongopposition of privacy advocates since it can be seen as encroaching onthe rule of law abiding citizens to conduct their affairs without beingwatched.

[0005] From the above it can be concluded that there is a need to avoidor soften this collision between security and privacy considerations byproviding a monitoring apparatus which can monitor events while stillpreserving the privacy of those being filmed. State of the art closedcircuit television (CCTV) cameras and other digital surveillance systemsdo not provide a solution to this problem.

SUMMARY

[0006] It is an aim of the invention to improve the existingsurveillance apparatus in such a way that the modern day requirementsput on both security and privacy are met. This result can be achieved byproviding a monitoring apparatus that monitors representations ofobjects such as for e.g. images of people present in a specific area,and decomposing the recorded image. A representation of an object mightbe identical to the object in its entirety, but can refer to acharacteristic part, such as the face of a person, of the object aswell. In a preferred embodiment the decomposed recorded image can onlybe viewed by reconstruction of the decomposed parts of the image if anumber of different parties consent to do so. Those parties couldinclude the police, a privacy advocacy group, and a party that isprimarily responsible for that specific area. Criteria for selection ofthe parties can e.g. include the requirement that at least one of theparties has a high degree of independency, i.e. is not involved in thesituation whatsoever.

[0007] In a preferred embodiment of the invention such a monitoringapparatus generates from a first data string representing the image twoor more output strings. There are several methods by which one cangenerate two or more output strings that in combination provide thefirst data string once again. In an exemplary embodiment dealing withe.g. three output strings, the first two of the three output strings isgenerated using random means such as e.g. measurements from an internalclock or thermal measurements. The third output string is then chosen sothat the binary addition modulo 2 of the three output strings yields thefirst data string. The output strings can be transmitted to separatestorage locations. The first data string and the two or more outputstrings can be combined at or near the monitoring apparatus in order toobtain an additional output string.

[0008] The monitoring apparatus can be a digital camera or other datasource having digital data strings as an output. In a variant themonitoring apparatus is an analog camera equipped with an analog-digitalconversion module.

[0009] The output strings and/or additional output strings can be storedin separate locations. The term “stored” here refers to having the dataavailable in any possible manner such as registration of the location ofthe data, saving the data on a data carrier, knowing the whereabouts ofthe data somewhere in a network etc.

[0010] Moreover it is noted that separate locations not necessarilyrefers to physical separation but also comprises e.g. different memoryareas in a single data memory, e.g. a hard disc. Preferably the separatelocations are not located in the neighbourhood of the camera. For thispurpose the monitoring apparatus can be equipped with networkcommunication means to enable transmission of the output strings and/oradditional output strings to these separate storage locations over anetwork. In an embodiment the strings are encrypted by encryption meansat the monitoring apparatus before they are sent over the network, usinge.g. encryption keys. Moreover state of the art compression techniquescan be applied to the various output strings before they are sent to thespecific storage locations.

[0011] In a variant at least one of the storage locations can besituated in or near the monitoring apparatus. It can e.g. be that allbut one storage locations are situated outside the neighbourhood of themonitoring apparatus. This provides the advantage that in the case thatall (minus one) output strings which are stored at a certain distanceand therefore have to be transported over that distance, could beintercepted during that data transport, the output string that is storedat or near the camera can not be intercepted. As a result the imagetaken by the monitoring apparatus cannot be reconstructed even if allstrings transmitted over the network have been intercepted. In anothervariant all storage locations might be situated in or near themonitoring apparatus. Storage within the monitoring apparatus can beobtained in various kinds of known data memories, like tapes, harddisc,CD, DVD etc. Compression of the data strings can be advantageouslyapplied in this variant as well.

[0012] In order to achieve the balance needed between security andprivacy considerations as described above the storage locationscontaining the various output strings are preferably not directlyavailable to all the parties concerned. For this purpose assessmentmeans are provided to assess the access rights of the parties to aparticular storage location storing at least one of the various outputstrings, such as e.g. a personal identification number (PIN) orpassword. In an embodiment of the invention all the various outputstrings are needed to reconstruct the image whereas the partiesconcerned only have access rights to just a single storage locationcontaining one output string. If a situation arises where one of theparties concerned or a third party not having access rights themselveswants to reconstruct the image as taken by the monitoring apparatus allparties having access rights need to consent to reconstruct theimage(s). Such a situation might e.g. be theft in a shop, riots in astadium or fire at the airport.

[0013] In a variant not all output strings are needed to reconstruct theimage but redundant output strings are generated at the monitoringapparatus by selection means to select selected output strings from thetwo or more output strings. Registration means such as the generation ofstrings using techniques in such a way that certain predefined subsetsallow for the reconstruction of the image can register which strings areneeded to reconstruct the image, by e.g. assigning a code to an outputstring. This can have advantages if for example one wants to givecertain parties greater authority in reconstucting the original datastring than other parties.

[0014] In a variant of the invention the monitoring apparatus isequipped with an event trigger for event detection. This event triggercan cause the generation of output strings and transmission of theseoutput strings to the separate storage locations to substantially takeplace only if e.g. a change of a substantially steady image is detected.Such a change might be the result of the movement of a person or anobject in an otherwise “movement-free” area. An event trigger can e.g.be based on well-known image-recognition techniques. An example is acamera installed near an emergency exit to a bank which begins recordingwhen it detects that someone is passing through the exit. This detectionwould take place through an event detector, which can take the form ofimage recognition software or of a physical detector such as an infrareddetector. Such event detectors alert the camera when the reference eventhas occurred. The presence of an event trigger at or near the monitoringapparatus has the advantage that less irrelevant data, i.e. the variousoutput strings generated from the first data string, are stored at theseparate locations.

[0015] In an embodiment of the invention the monitoring apparatus isequipped with watermarking means in order to assign watermarks to thefirst datastrings and/or output strings and/or additional outputstrings, e.g. by insertion of a watermark string in the respectivestrings. These watermarks can comprise an identifier referring to itsorigin, i.e. the monitoring apparatus. Moreover the watermark cancomprise a timestamp referring to the timeframe in which the first datastring was recorded or in which the two or more output strings and/oradditional output strings were recorded. Also the storage location forthe specific output string can be part of said watermark, e.g. adownload watermark.

[0016] It is noted that the previous embodiments or variants of theprevious embodiments of the invention can be combined.

SHORT DESCRIPTION OF THE DRAWINGS

[0017]FIG. 1 shows a security concept according to an embodiment of theinvention;

[0018]FIG. 2 shows a monitoring apparatus according to an embodiment ofthe invention.

DESCRIPTION

[0019] For the purpose of teaching the invention, preferred embodimentsof the method and devices of the invention are described in the sequel.It will be apparent to the person skilled in the art that otheralternative and equivalent embodiments of the invention can be conceivedand reduced to practice without departing from the true spirit of theinvention, the scope of the invention being only limited by the claimsas finally granted.

[0020] In FIG. 1 an embodiment of the invention is shown illustratingthe employed security system. The system comprises a monitoringapparatus 1, e.g. a data source such as a digital camera connected to aprocessor 2. The processor 2 can be, but is not necessarily, an integralpart of the monitoring apparatus 1. The processor 2 in an embodimentgenerates at least two output strings from a first data string providedby the monitoring apparatus 1 and transmits these output strings toseparate storage locations 3. Those storage locations 3 are accessibleby different parties 4 a . . . d, each of them having accession rightsfor e.g. only one storage location, by means of an individualidentifier/password combination, stored in the storage system 3. Thestorage locations may be physically located within one storage system orwithin physically separated storage systems. In an embodiment of theinvention one party has the rights to access to one de-compiled file andupload it to processor 2 when desired. In that way re-compilation of (areplica of) the original (image) file can be achieved after severalparties have accessed their own de-compiled files and uploaded them tothe processor 2. In processor 2 uploaded files are combined, resultingin a reconstruction of the original.

[0021] In FIG. 2 an embodiment of the monitoring apparatus 1 accordingto the invention is shown, identifying several modules 2-10 that in thispreferred embodiment are part of a digital camera. It is noted that anykind of data source can be employed, e.g. also an analog camera theoutput of which can be digitalised by an analog-digital conversionmodule. In the embodiment as shows in FIG. 2 the processor 2 is anintegral part of the camera.

[0022] The camera 1 monitors an area to be watched. Such areas mighte.g. be main city squares, shopping malls, airports or stadiums hostingsports events or rock concerts. The camera 1 is equipped with eventtriggering means that only activate the processor 2 of the camera 1 if“something happens”. One might e.g. think of a camera 1 monitoring anormally speaking “movement free” area, the event triggering any kind ofmovement in this area. Such event triggers can be implemented eitherusing well-known image recognition techniques or using physical meanssuch as infrared detection.

[0023] The camera 1 provides a first data string which is generated as aconsequence of the monitoring of representation such as images of personentering the area to be watched. The first data string is fed to theprocessor 2 which generates at least two output strings from the firstdata string and is suited to generate additional output strings andwatermark the strings as will be explained in more detailed now.

[0024] Let the following parameters be defined as:

[0025] t Number of parties

[0026] P_(—)1, . . . ,P_t Parties receiving the shared images

[0027] C Camera C

[0028] K_(—)1, . . . ,K_t Secret keys of the parties 1 to t

[0029] T_C Time interval at camera C

[0030] DK_i Derived key for party i

[0031] D_{T_C} Complete image for camera C at time T

[0032] D_{{T_C}_i}} Un-watermarked shares, i from 1 to t

[0033] M_{{T_C}_i} Watermarked shares, i from 1 to t

[0034] The various parties whose consent will be needed to reconstructthe representation are denoted as P_(—)1, P_(—)2, . . . ,P_t. Aparticular camera 1 is denoted by C. The values that follow (such askeys and so forth) will all be taken to be indexed with respect to thecamera C. This will be denoted by the subscript C.

[0035] When a particular location is to have a camera 1 C installed, thecamera 1 is provided, in a tamper-resistant module, the keys K_(—)1,K_(—)2, . . . ,K_t of the parties P_(—)1, . . . ,P_t respectively. Thiscan be done using PKI for example, or otherwise can be done at themanufacturing stage itself.

[0036] The camera 1 will have a defined time interval that contains apredetermined number of data frames (or alternately a predeterminedelapsed time). Let the time on the camera be defined as T_C. Thus inthis embodiment T_C=0 for the first frame, T_C=1 for the second, and soforth. For each value of i, 1<=i<=t, the camera C (in fact processor 2)shall calculate the following key for the present value of T_C:

[0037] DK_i=Derived Key(P_i, T_C, C, (optionally-names of the partiesP_(—)1, . . . ,P_t)) (*)

[0038] This derived key can be obtained in numerous ways. In thisparticular embodiment a one-way hash function like SHA-1 will be used.

[0039] As well, each of the parties P_(—)1, . . . ,P_t shall calculate(*) for its own value of i.

[0040] The camera 1 shall then transmit the current digital image,denoted D_{T_C} as follows. The image D_{T_C} will first be assigned adigital watermark by the processor 2, to obtain a new D_{T_C} containinga general watermark. The image D_{T_C} shall be divided into a number oft equal “portions”, in the following manner. Regarding each D_{T_C} as amatrix over some ring (which depends on the resolution of the picture),the processor 2 shall assign arbitrary matrices D_{{T_C},i}, for i=1 tot−1, in an independent, arbitrary (random) manner. Then the last matrixD_{{T_C},t} shall be assigned in such a way such that:

[0041] D_{{T_C}_(—)1}+D_{{T_C}_(—)2}+ . . . +D_{{T_C}_t}}=D_{T_C}

[0042] Now the processor 2 shall calculate a new image M_{{T_C}_i} basedon D_{{T_C}_i}, where M_{{T_C}_i} is equal to D_{{T_C}_i}, with adownload digital watermark that contains the identifier of C, T_C, i,and the current date. As well, the values of the other parties (thosevalues in 1, . . . ,t not equal to i) may optionally be placed on thedigital watermark.

[0043] The image (i.e. matrix) M_{{T_C}_i} is then sent to the party iby e.g. networking communication means 9, encrypted with K_i. In oneembodiment, a hashed value of M_{{T_C}_i} is sent to all the parties 1through t.

[0044] Now suppose one of the parties wants to reconstruct the image.Since all the parties have a completely random image, none will be ableto reconstruct the image without the co-operation of the other parties.

[0045] However, if the parties operate together, together they will beable to reconstruct the image by combining the constituent parts. Inthis embodiment an uploading watermark is added to each share M_{T_C}_i}before the re-composition begins. Each party can then verify if theshare it is receiving from the other party is valid.

[0046] Below the method according to the invention will be illustratedby a simplified example. In this example watermarking and encryption ofthe strings are not shown. Starting from an original data stringproduced by the camera:

[0047] 01111000011110111111110001100111110000001101101110 . . .

[0048] three independent random output strings are generated. string a:11010010001010111100011011101110000100010101100011 . . . string b:11000001011100011011110110101000010100110100011001 . . . string c:01110100111000011110010011101111100100011010100000 . . .

[0049] According to an embodiment of the invention those three outputstrings and the original data string are combined by calculating foreach bit position the sum modulo 2 (indicated as “[+]”) of the bitvalues of string a, string b and string c. E.g. for bit position 1 (fromthe left) this is 0[+]1[+]1[+]0=0; for bit position 2 this is1[+]1[+]1[+]1=0; for bit position 3 this is 1[+]0[+]0[+]1=0; for bitposition 4 this is 1[+]1[+]0[+]1=1; etc. This results in a fourthadditional output string d as shown below:

[0050] string d: 00011111110000000110001111001110000100110110110100 . ..

[0051] All (four) output strings a-d (generated from the first datastring) are stored separately in storage locations 3 and/or 3′.

[0052] For retrieval of a (re-composed) replica of the first data stringfrom the separately stored output strings a-d, those strings arecombined by calculating for each bit position the sum modulo 2 (“[+]”)of the four bit values of the individual output strings, string a:110100100010101111000110111011100001000101011 . . . string b:110000010111000110111101101010000101001101000 . . . string c:011101001110000111100100111011111001000110101 . . . string d:000111111100000001100011110011100001001101101 . . .

[0053] resulting in the replica string:

[0054] 011110000111101111111100011001111100000011011 . . .

[0055] which is identical to the first data string.

[0056] Expanding this example with watermarking the first data string bythe processor 2 as well as the output strings strings, results into thefollowing.

[0057] Again, the camera string is:

[0058] 0111100001111011111111000110011111000000 . . .

[0059] Watermarking with a (in this case very simple 6-bits watermarkheader string “000000”) results into:

[0060] 0000000111100001111011111111000110011111000000 . . .

[0061] Firstly, the processor 2 generates three random output strings:string a: 1101001000101011110001101110111000010001010110 . . . string b:0101110001101111011010100001010011010001100101 . . . string c:0001111001001110111110010001101010000010100110 . . .

[0062] After that processor 2 calculates output string 4 by summingmodulo 2 bit-by-bit the watermarked camera string and the random outputstrings 1 to 3, resulting into:

[0063] string d: 1001000111101011101110100001000111011101010101 . . .

[0064] Next, the output strings are provided with individual (download)watermark headers “000001”, “000010”, “1000011” and “000100”respectively: a: 000001 1101001000101011110001101110111000010001010110 .. . b: 000010 0101110001101111011010100001010011010001100101 . . . c:000011 0001111001001110111110010001101010000010100110 . . . d: 0001001001000111101011101110100001000111011101010101 . . .

[0065] These output strings may be encrypted in the processor 2 or in aseparate encryption module 8 and transmitted to separate storagelocations 3 and/or 3′, where they are stored, either in encrypted formor in original (decrypted) form.

[0066] In the retrieving and re-composition stage of the process, theoutput and additional output strings a to d are transmitted to thecentral processor 2, where the individual watermarks will be checked onvalidity. If correct, the individual watermarks are deleted, resultinginto the strings a-d: string a:1101001000101011110001101110111000010001010110 . . . string b:0101110001101111011010100001010011010001100101 . . . string c:0001111001001110111110010001101010000010100110 . . . string d:1001000111101011101110100001000111011101010101 . . .

[0067] which, bit-by-bit, are summed modulo 2, resulting into a replicaof the watermarked first data string as generated by the camera 1:

[0068] 0000000111100001111011111111000110011111000000 . . .

[0069] The camera watermark can be checked then and, if correct, thewatermark can be deleted, resulting into a replica of the first datastring:

[0070] 0111100001111011111111000110011111000000 . . .

[0071] It is noted that it may be advantageous in view of security togenerate more output strings then actually will be used forre-composition. A method hereto is to generate a number of redundantoutput strings in the processor, indicated by 2′ in FIG. 2, and to labelthose strings, within those strings themselves or within the processor2′, by an redundancy/relevance code. Only strings having such codeindicating that that string is essential for recovering the originalstring, will be processed in processor 2 in the reconstruction processof the image as described above. For instance, in the above example notthree but six decomposition strings are generated, but string d iscalculated only using strings a to c (equal to the above example);strings e to g only are redundant “dummies”. In this example theredundancy/relevance code is formed by the first watermark bit. Another,may be better, option is to register, in the processor 2′ register 6,which strings are relevant for recovering a replica of the originalstring, and which are not. a:00000111010010001010111100011011101110000100010101100 . . . b:00001001011100011011110110101000010100110100011001011 . . . c:00001100011110010011101111100100011010100000101001101 . . . d:00010001011001101110100001111101010101110010111010101 . . . e:10010111000001001011011000001001111110010100011011110 . . . f:10011011010001011100011010001011111111010110110001100 . . . g:10011111011000000011011000010111000101000111000101100 . . .

[0072] Instead of producing a number of redundant random strings (e-g),another option is to calculate one or more additional output stringsfrom one or more random strings, in the same way as string d wascalculated form strings a to c. For instance, first a series of fourrandom strings is generated, followed by a fifth string, which iscalculated by summing modulo two the bits of the original string andthose of random strings one and three (shorter: string e results fromstrings a and c). Further, a sixth string f is made, by summing modulotwo the bits of (again) the first data string and the random strings (anarbitrary choice) a, c and d (in short: string f results from strings a,c and d). In this way another redundancy is created, e.g. by the stringcouples a, c and e resp. a, b, d and f. An replica of the first datastring can be reconstructed from either the first couple of strings a, cand e, or from the second couple of strings a, b, d and f, in both caseby summing modulo two the respective bits of the strings of the firstcouple or by summing modulo two the respective bits of all strings ofthe second couple. Processor 2 needs to register in register 6 whichstrings belong to respective couples and are able to reproduce togethera replica of the original.

[0073] Finally, it may be advantageous to make use of differentwatermarks for downloading and uploading of the output stringsrespectively. In that case, on downloading the strings to the storagelocation 3, the processor 2 may assign download watermarks to the outputstrings, while the storage means 3 may assign, on uploading from thestorage location to the processor 2, upload watermarks. The same mayapply for the first data string and its reconstructed string.

[0074] In order to enable the monitoring apparatus 1 to perform thefunctions as mentioned above as well as additional functions, themonitoring apparatus 1 can be equipped with several hardware or softwaremodules. FIG. 2 shows:

[0075]2—processor substantially enabling the generation of the outputstrings and the additional output strings as well as the watermarkingstrings;

[0076]2′—selection means as part of the processor that enables redundantstrings to be generated, i.e. the selected output strings;

[0077]3—storage locations for the output strings not being an integralpart of the camera;

[0078]3′—storage location(s) for the output strings being an integralpart of the camera;

[0079]5—event trigger;

[0080]6—register to store the relevance of the selected output string tothe reconstruction process of the first data string;

[0081]7—compression means;

[0082]8—encryption means;

[0083]9—network communication means;

[0084]10—assessment means;

[0085] The function of the processor 2 and 2′ and register 6 andencryption means 8 has been explained above in detail. The separatestorage of the various data strings, i.e. output strings, additionaloutput strings and/or selected output strings, can be done at or nearthe camera 1 as well as outside the camera as shown by 3′ resp. 3. Asstated before separate storage not necessarily refers to separatephysical locations. The separate storage locations are provided withassessing means 10 in order to determine the access right of a partyrequesting access to data string stored at a specific storage location.Only if a party is authorized this party can actually retrieve the datastring stored at that specific storage location.

[0086] Advantageously compression of the data strings, applying state ofthe art compression techniques, is performed by compression means 7.Compressing of the data strings can be done in order to reduce storagecapacity at the storage locations and to reduce bandwidth usage if thedata strings are to be transmitted over a network.

[0087] The monitoring means 1 is preferably supplied with networkscommunication means 9 in order to enable the transmittal of the variousoutput strings to separate storage locations away from the monitorapparatus.

[0088] As will be clear to the man skilled in the art several of themodules can coincide, such as the encryption means that might be part ofthe processor 2 as well as being a separate module 8. Moreover thesequence of the modules can be modified, e.g. compression of the data at7 can also be applied to the data strings before encryption of the datastrings has been performed.

1. Monitoring apparatus for monitoring a representation of an object,said monitoring apparatus comprising means for converting saidrepresentation into at least one first data string; means for generatingtwo or more output strings from which said first data string can bereconstructed and means for transmitting said two or more output stringsto separate storage locations
 2. Monitoring apparatus according to claim0 wherein said apparatus is a digital camera.
 3. Monitoring apparatusaccording to claim 0 wherein said apparatus is an analog camera theoutput of which is digitalised by an analog-digital conversion modulefor obtaining said first data string.
 4. Monitoring apparatus accordingto any of the claims 0-0 wherein combination means are provided tocombine said two or more output strings with each other and/or with saidfirst data string resulting in at least one additional output string. 5.Monitoring apparatus according to any of the preceding claims whereinnetwork communication means are provided for transmission of said two ormore output strings and/or additional output string over a network. 6.Monitoring apparatus according to claim 0 wherein said separate storagelocations are not part of said monitoring apparatus and said network isused for transmission of said two or more output strings and/oradditional output strings to said separate storage locations 7.Monitoring apparatus according to any of the claims 0-0 wherein at leastone separate storage location for storing said output string and/oradditional output string is located at or near said monitoringapparatus.
 8. Monitoring apparatus according to claim 0 wherein theseparate storage locations being part of said monitoring apparatus areprovided with means to assess the access rights of parties requestingretrieval or access to of one or more output strings and/or additionaloutput strings.
 9. Monitoring apparatus according to any of thepreceding claims wherein event triggering means are provided in order togenerate said two or more output strings and transmit these outputstrings only if said representation has changed with respect to anearlier representation.
 10. Monitoring apparatus according to any of thepreceding claims wherein selection means are provided to obtain aselection of selected output strings from said two or more outputstrings.
 11. Monitoring apparatus according to claim 0 wherein saidselected output strings are combined with each other and said first datastring by using said combination means as recited in claim 4 to obtainat least one additional output string
 12. Monitoring apparatus accordingto claims 0 or 0 wherein registration means are provided to registersaid selected output strings and/or said additional output string. 13.Monitoring apparatus according to claim 0 wherein said registrationmeans assigns a code to said selected output strings and/or additionaloutput string.
 14. Monitoring apparatus according to any of thepreceding claims wherein compression means are provided to compress saidfirst data string, said output strings, said selected output stringsand/or said additional output strings.
 15. Monitoring apparatusaccording to any of the preceding claims wherein watermarking means areprovided to assign a watermark string to said first datastring. 16.Monitoring apparatus according to any of the preceding claims whereinwatermarking means are provided to assign a watermark string tosubstantially each of said two or more output strings and/or said atleast one additional output string and/or said replacement string. 17.Monitoring apparatus according to claims 0 or 0 wherein saidwatermarking means assign a watermark string to said first datastringand/or said two or more output strings comprising an identifierreferring to said monitoring apparatus.
 18. Monitoring apparatusaccording to claim 0 wherein said monitoring apparatus identifiercomprises a time stamp referring to the generation of said two or moreoutput strings or the transmission of said two or more output strings tosaid separate storage locations.
 19. Monitoring apparatus according toclaims 0 or 0 wherein said watermark string comprises an identifierreferring to said separate storage locations.
 20. Monitoring apparatusaccording to any of the preceding claims wherein encryption means areprovided to encrypt said two or more output strings and/or additionaloutput string and/or selected output strings before these strings aretransmitted by said transmission means to said separate storagelocations.
 21. Monitoring apparatus according to claim 0 wherein saidencryption means use an encryption key which is a function of saididentifiers referring to said separate storage locations.
 22. A computerprogram for running on a computer system at least including softwarecode portions performing generation of two or more output strings fromwhich a first data string can be reconstructed, said first data stringbeing obtained from converting a representation of an object monitoredby a monitoring apparatus and transmission of said output data stringsto separate storage locations.
 23. A computer program according to claim0 wherein said software code portions further include combinationportions to combine said two or more output strings with each otherand/or with said first data string resulting in at least one additionaloutput string.
 24. A computer program according to claims 0 or 0 whereinsaid software code portions further include portions to select selectedoutput strings from said two or more output strings.
 25. A computerprogram according to claim 0 wherein said software code portions furtherinclude portions to combine said selected output strings with each otherand first data string to obtain at least one additional output.
 26. Acomputer program according to any of the claims 0-0 wherein saidsoftware code portion further include portions to compress said firstdata string, said output strings, said additional output strings and/orsaid selected output strings.
 27. A computer program according to any ofthe claims 0-0 wherein said software code portions further includeportions to assign a watermark to said first data string, said outputstrings, said additional output strings and/or said selected outputstrings.
 28. A computer program according to claim 0 wherein saidwatermark comprises an identifier referring to said monitoring apparatusand/or a time stamp referring to the generation of said two or moreoutput strings or the transmission of said two or more output strings tosaid separate storage locations and/or an identifier referring to saidstorage locations.
 29. A computer program according to any of the claims0-0 wherein said software code portions further include portions toencrypt said two or more output strings and/or additional output stringand/or selected output strings.
 30. A data carrier, stored with dataloadable in a computer memory said data representing a computer programfor running on a computer system at least including software codeportions for performing generation of two or more output strings fromwhich a first data string can be reconstructed said first data stringbeing obtained from converting a representation of an object monitoredby a monitoring apparatus and transmission of said output data stringsto separate storage locations.
 31. A data carrier according to claim 0wherein said software code portions further include portions asdescribed in at least one of the claims 0-0.
 32. A data communicationnetwork comprising at least one monitoring apparatus generating a firstdata string by converting a representation of an object monitored bysaid monitoring apparatus said first data string being processed by aprocessor generating two or more output strings from which said firstdata string can be reconstructed said monitoring apparatus beingcommunicatively connected to said data communication network by networkcommunication means to transmit said two or more output strings oversaid data communication network to storage locations to store at leastone of said one or more substrings.